Privacy and data protection policy

Last updated: September 28, 2026

This English translation is provided for information purposes. In case of any discrepancy, the Spanish version (Política de privacidad) prevails.

At NeuroNowak I treat your data the way I’d like mine to be treated: I only ask for what’s necessary, I store it on a server in Spain and I don’t give it to anyone. Here you’ll find, in detail, what data I process, what for, and what rights you have.

1. Who is responsible

Data controller: Aurélie Nowak (trade name NeuroNowak)
NIE: X9986154Z
Address: Calle Sierra de Ronda, 1 · 29720 La Cala del Moral (Málaga), Spain
Email for any data matter: info@neuronowak.com
Phone: +34 650 596 740

2. An important clarification: health data

NeuroNowak offers well-being brain training. It isn’t a healthcare service and I don’t make diagnoses. Even so, part of what you tell me (how you sleep, your stress level, your goals, the medication you take or the progress you notice after each session) is considered by law to be health-related data, which has special protection.

That’s why I only process that data with your explicit consent, only use it to support you, am the only one who accesses it, and never use it for advertising or share it.

3. What data I process and why

3.1. When you write to me or call me

Data: name, phone number, email and whatever you tell me in your message (website forms, WhatsApp, phone or email).
Purpose: to reply to you and, if you wish, give you an appointment.
Legal basis: your request (pre-contractual measures) and your consent when you submit the form.
How long: until your inquiry is resolved and, if you don’t become a client, for a maximum of 12 months.

3.2. The “Sleep Circle” test and its guide

Data: name, email, language, your answers to the test (including the guidance questions about medication or signs worth checking with a doctor), the resulting profile and how you found the test.
Purpose: to send you your result, the guide for your profile and a short series of emails over 14 days related to your result. Also to be able to help you better if you later decide to write to me.
Legal basis: your explicit consent, which you give by ticking the box before submitting the test (Art. 6.1.a and 9.2.a GDPR). You can unsubscribe from any email with one click.
Automated profile: the test assigns you an indicative profile based on your answers. It isn’t a diagnosis, has no legal effect and isn’t used to decide anything about you.
How long: until you unsubscribe or, at most, 24 months from your last contact.

3.3. If you’re a client: your training and your private area

Data: identification and contact details, date of birth, language, the intake form (reason for coming, background, medication and habits), your goals, your rating of each session (rest, clarity, calm, energy and your comments), your appointments, your packages and payments.
Purpose:

To plan and follow up on your sessions.
To give you access to your private area on neuronowak.com, where you can see your progress, remaining sessions, appointments, reports and recommendations, and where you can book.
To remind you of appointments and let you know when you have few sessions left, by WhatsApp or email.
To issue invoices and meet accounting and tax obligations.

Legal basis: our service relationship (Art. 6.1.b), your explicit consent for health data (Art. 9.2.a), which you sign on the intake form and confirm when you first log in to your private area, and legal invoicing obligations (Art. 6.1.c).
How long:

Follow-up and health data: for as long as our work together lasts and up to 24 months after your last session, in case you come back. After that, it’s deleted. If you ask me to delete it sooner, I will.
Invoices and payment data: 6 years, as required by Spanish commercial and tax law.

3.4. Security of your private area

I record when each account is accessed and any failed login attempts, to protect your data against unauthorised access. Legal basis: legitimate interest in security. These records are kept for 12 months.

3.5. News and content (optional)

Only if you expressly tick the box, I’ll send you news, articles or offers from NeuroNowak by email. Legal basis: your consent. You can unsubscribe at any time from the email itself or by writing to me.

3.6. Testimonials (optional)

Only if you authorise it in writing, I may share your testimonial anonymously, without your image or full name. You can withdraw permission whenever you like.

4. Minors

If the client is under 14, consent is given by their parent or legal guardian, who is also the person who accesses their private area. Between 14 and 17, the minor can consent themselves, and I encourage the family to be kept informed.

5. Who else can see your data

I don’t share your data with anyone, except where required by law (for example, with the Spanish tax authorities). To run the website and the service I use the following providers, who process data only on my instructions and under a data processing agreement:

Raiola Networks (Spain): hosting for the website, the private area and email. Your follow-up data is stored here, on servers in Spain.
Brevo (Sendinblue SAS, France, EU): sending the test emails, private area notifications and, if you’ve asked for them, news.
Google (Google Ireland Ltd.): appointment calendar. Only your name and the time appear in the calendar, never health data. The website also uses Google Analytics; details are in the cookie policy.
WhatsApp (WhatsApp Ireland Ltd.): when we message each other on WhatsApp. Automated messages from the private area are appointment and session reminders, with no health data.
An accounting firm, if I use one, for bookkeeping and invoicing.

Some of these providers belong to groups headquartered in the United States. When data is transferred outside the European Union, it’s done with the safeguards required by the GDPR: the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

6. How I protect your data

All website traffic is encrypted (HTTPS).
Private area passwords are stored encrypted: not even I can see them.
Each client can only see their own data.
Only I have access to the dashboard where the client files are kept.
If you ask me to delete your data, it’s completely removed from the private area.

7. Your rights

You can ask me at any time for:

Access: to know what data of yours I hold and receive a copy.
Rectification: to correct anything that’s wrong.
Erasure: to delete your data.
Objection and restriction: to stop using it, or to use it only for something specific.
Portability: to receive it in a file you can take with you.
Withdrawal of consent whenever you like. Anything done before remains valid.

Just write to me at info@neuronowak.com. I’ll reply within one month at most. If you disagree with my answer, you can file a complaint with the Spanish Data Protection Agency (AEPD).

8. Changes to this policy

If I change anything important, I’ll update it here with the date and, if you’re a client, I’ll also let you know in your private area.